CVE-2026-25611: MongoDB Inc MongoDB Server

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

Affected products

• MongoDB Inc MongoDB Server: from 8.2, before 8.2.4 (fixed in 8.2.4); from 8.0, before 8.0.18 (fixed in 8.0.18); from 7.0, before 7.0.29 (fixed in 7.0.29)

Published 2026-02-10. Last modified 2026-06-17.